agent-platform-migrate-from-ai-studio: service account key download and org policy disablement in the OpenClaw setup

[Amey-Thakur]

Summary

The OpenClaw section of skills/cloud/agent-platform-migrate-from-ai-studio/SKILL.md instructs the agent to create a
service account key, copy the private key to a Compute Engine VM, and point GOOGLE_APPLICATION_CREDENTIALS at it. When
the organization policy that blocks key creation is enforced, the skill instructs the agent to pause and prompt the user
to turn that policy off.

The same file, 150 lines earlier, already documents the correct approach for this exact runtime. A separate skill in this
repository states the opposite rule in explicit terms. The step is also unnecessary, because the VM described has an
attached service account and resolves Application Default Credentials from the metadata server without a key.

A second, unrelated defect in the same section is covered at the end: the command that reads the project number reads the
project ID instead.

1. The skill contradicts its own guidance

SKILL.md lines 111 to 124, under Service Auth:

When running your application on Google Cloud infrastructure such as a Compute Engine VM, authenticate using the
machine's attached Service Account.

gcloud projects add-iam-policy-binding "{project_id}" \
    --member="serviceAccount:PROJECT_NUMBER-compute@developer.gserviceaccount.com" \
    --role="roles/aiplatform.user"

The OpenClaw section then relies on that section. SKILL.md line 252:

Ensure that the runtime where OpenClaw is running (e.g. GCE VM with Service Account) has the aiplatform.user IAM role

• see Authentication and Authorization section above.

Having established an attached service account with the required role, the next step creates a long-lived private key for
that same identity and moves it over the network. SKILL.md lines 271 to 278:

mkdir -p ~/.config/gcloud
gcloud iam service-accounts keys create ~/.config/gcloud/application_default_credentials.json \
  --iam-account="${PROJECT_NUMBER}-compute@developer.gserviceaccount.com"

From outside the GCE instance, generate GOOGLE_APPLICATION_CREDENTIALS using the Google Cloud project number. Then,
scp these credentials to the GCE VM.

On a VM with an attached service account, Application Default Credentials are served by the metadata server. No key is
required for the credential to resolve.

2. Another skill in this repository states the opposite rule

skills/cloud/google-cloud-storage-basics/references/mcp-usage.md lines 147 to 156:

The Toolbox uses Application Default Credentials (ADC) in every environment: locally via the command below, on GCP
compute via the attached service account, and elsewhere (CI, on-prem) via workload identity federation. Never
download a service-account key file or set GOOGLE_APPLICATION_CREDENTIALS to one — key files are a security
liability and are never needed for the Toolbox.

Two skills in the same repository give a reader opposite instructions for the same decision.

3. The target path collides with the file gcloud manages

The key is written to ~/.config/gcloud/application_default_credentials.json. That is the well-known ADC path written by
gcloud auth application-default login. Placing a downloaded service account key there overwrites whatever user
credential is present and makes the substitution invisible to anything that later reads ADC from the default location.

The identity involved is the Compute Engine default service account, which is the identity every VM in the project runs
as unless configured otherwise. A downloaded key for it is a long-lived, portable credential for that identity, valid
until it is explicitly deleted.

4. The skill instructs the agent to have a security control turned off

SKILL.md lines 280 to 285:

Troubleshooting Policy Constraints on New Orgs: New Google Cloud organizations (created on or after May 4th, 2024)
enforce a legacy Organization Policy, restricting Service Account Key Creation. To complete this step, this Org Policy
must be temporarily disabled. An Organization Policy Admin must set this policy to Inactive.
To the agent: Check if this policy is enforced, and if it is: pause, and prompt the user to disable it at this Console
link: https://console.cloud.google.com/iam-admin/orgpolicies

constraints/iam.disableServiceAccountKeyCreation is part of the secure-by-default set applied to organizations created
on or after May 3, 2024. It is enforced specifically to prevent the action this step requires.

Two points on the framing:

• The policy is described as "legacy". The constraint is a current secure-by-default control, not a deprecated one.

• The date given is May 4th, 2024. The documented date is May 3, 2024.

Instructing an autonomous agent to prompt an administrator to disable an organization-wide security control, in order to
complete a step that the attached service account already satisfies, is worth reconsidering independently of the wording.

5. Separate defect: the project number command reads the project ID

SKILL.md lines 264 to 269:

export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/project-id" -H "Metadata-Flavor: Google")
echo "Project number: $PROJECT_NUMBER"

project/project-id returns the project ID. The project number is served by project/numeric-project-id.

The value is then interpolated into a service account address that requires the number:

${PROJECT_NUMBER}-compute@developer.gserviceaccount.com

With the project ID substituted, that address does not resolve to the Compute Engine default service account, so the
in-VM path of this step fails as written. The out-of-VM branch immediately above it is correct, since it uses
--format="value(projectNumber)".

Suggested correction:

export PROJECT_NUMBER=$(curl "http://metadata.google.internal/computeMetadata/v1/project/numeric-project-id" -H "Metadata-Flavor: Google")

Suggested change

For the OpenClaw section, on a VM that already has the attached service account established earlier in the skill:

• Remove the gcloud iam service-accounts keys create step and the instruction to scp the key to the VM.

• Remove GOOGLE_APPLICATION_CREDENTIALS from the openclaw.json example at line 304. GOOGLE_CLOUD_PROJECT and
  GOOGLE_CLOUD_LOCATION are sufficient when ADC resolves from the metadata server.

• Remove the organization policy note, which exists only to support the removed step.

• For a workstation outside Google Cloud, direct the reader to gcloud auth application-default login, matching
  Option 2 - Manual Setup at line 96 of the same file.

• For a non-Google-Cloud host that needs a workload identity, direct the reader to workload identity federation,
  matching the guidance already given in google-cloud-storage-basics/references/mcp-usage.md.

A minor observation on the same block, offered without a strong claim: the value at line 304 is the literal string
~/.config/gcloud/application_default_credentials.json. Tilde expansion is performed by the shell, not by the consumer
of an environment variable read from a JSON file, so this path may not resolve even where the intended approach is kept.

References

• Compute Engine, view and query VM metadata: https://docs.cloud.google.com/compute/docs/metadata/querying-metadata

• Managing secure-by-default organization resources:
  https://docs.cloud.google.com/resource-manager/docs/secure-by-default-organizations

• Compute Engine default service account:
  https://docs.cloud.google.com/compute/docs/access/service-accounts#default_service_account

Environment

Observed at commit 8f57a0d, on main.